Normative Instruction BCB No. 704 — Discloses procedures, documents, deadlines, and information required for authorization requests for foreign exchange brokers, securities brokers, securities distributors, and virtual asset service providers

NORMATIVE INSTRUCTION BCB NO. 704, OF JANUARY 29, 2026

Discloses procedures, documents, deadlines, and information required for the processing of authorization requests related to the operation of foreign exchange brokerage firms, securities and securities brokerage firms, securities distribution firms, and virtual asset service providers.

The Head of the Financial System Organization Department (Deorf), acting in substitution, in exercise of the authority granted by Articles 23, item I, letter “a”, and 98, item VI, of the Internal Regulations of the Central Bank of Brazil, annexed to Resolution BCB No. 340, of September 21, 2023, based on Article 4 of Resolution BCB No. 519, of November 10, 2025, Article 35 of Resolution BCB No. 277, of December 31, 2022, and Article 16, item III, of Resolution BCB No. 130, of August 20, 2021,

RESOLVES:

CHAPTER I

SUBJECT MATTER AND SCOPE OF APPLICATION

Article 1. Procedures, documents, deadlines, and information required for the processing of authorization requests related to the operation of foreign exchange brokerage firms, securities and securities brokerage firms, securities distribution firms, and virtual asset service providers are hereby disclosed.

CHAPTER II

PROCESSING OF APPLICATIONS

Section I

General Provisions

Article 2. Authorization requests referred to in this Normative Instruction must be filed with the Central Bank of Brazil, addressed to the Financial System Organization Department (Deorf), in accordance with current regulations, accompanied by the relevant documents and information.

Article 3. The institution must include in the System of Information on Entities of Interest of the Central Bank (Unicad) the information necessary for the processing of the applications, in accordance with current regulations.

Article 4. The document models provided for in this Normative Instruction are available in the Financial System Organization Manual (Sisorf), accessible via the Central Bank of Brazil’s website.

Section II

Authorization for Operation

Subsection I

Application by Foreign Exchange Brokerage Firms, Securities and Securities Brokerage Firms, Securities Distribution Firms, and Virtual Asset Service Providers Not Yet in Operation

Article 5. The authorization request for operation must be accompanied by the following documents and information:

I - application, in the form of model Sisorf 08.23.010.001;

II - declaration, signed by the controllers, stating that they meet the economic and financial capacity requirement, compatible with the capital necessary for the institution’s structuring and operation, as well as contingencies arising from market dynamics, in the form of model Sisorf 08.23.020.001, except in the case of a company controlled by an institution authorized by the Central Bank of Brazil, or for a controller who is a natural person resident or domiciled abroad or a legal entity headquartered abroad;

III - information and supporting documentation demonstrating compliance with the economic and financial capacity requirement, compatible with the capital necessary for the institution’s structuring and operation, as well as contingencies arising from market dynamics, through which the equity evolution over the last three fiscal years can be verified, regarding controllers who are natural persons resident or domiciled abroad or legal entities headquartered abroad;

IV - declaration of the origin of resources used by controllers and holders of qualified participation in the integration of share capital, in the form of model Sisorf 08.23.020.002, except for controllers or holders of qualified participation who are institutions authorized by the Central Bank of Brazil;

V - executive summary of the business plan, in the form of Annex II;

VI - declaration, signed by controllers and holders of qualified participation who are natural persons, stating that they meet the requirement of unblemished reputation and the conditions established by legislation and current regulations, in the form of model Sisorf 08.23.020.003;

VII - declaration, signed by controllers and holders of qualified participation, excluding natural persons, stating that they meet the conditions established by legislation and current regulations, in the form of model Sisorf 08.23.020.004, except for controllers or holders of qualified participation who are institutions authorized by the Central Bank of Brazil;

VIII - authorization, signed by controllers and holders of qualified participation, except for controllers or holders of qualified participation who are institutions authorized by the Central Bank of Brazil, in the form of model Sisorf 08.23.020.003 or 08.23.020.004:

a) to the Brazilian Federal Revenue Secretariat, for the provision to the Central Bank of Brazil of the Individual Income Tax Return or the Legal Entity Economic-Fiscal Information Declaration, as applicable, regarding the last three fiscal years, except in the case of a legal entity headquartered abroad or an investment fund, for the exclusive use of the Central Bank of Brazil in the respective authorization process;

b) to the Central Bank of Brazil, for access to information about themselves in any public or private registration and information system, including judicial or administrative proceedings and police inquiries;

c) to the Central Bank of Brazil, to carry out the processing and shared use of personal data belonging to them, including those considered sensitive and covered by confidentiality, in accordance with current legislation;

IX - declaration, signed by elected or appointed administrators, stating that they meet the requirements of unblemished reputation and technical qualification compatible with the functions to be exercised during the term of office, as well as the conditions established by legislation and current regulations, in the form of model Sisorf 08.23.020.005 or 08.23.020.006;

X - authorization, signed by elected or appointed administrators, in the form of model Sisorf 08.23.020.005 or 08.23.020.006, granting the Central Bank of Brazil, during the process of approval of their names and the period of office:

a) access to information about themselves, in any public or private registration and information system, including judicial or administrative proceedings and police inquiries;

b) to carry out the processing and shared use of personal data belonging to them, including those considered sensitive and covered by confidentiality, in accordance with current legislation;

XI - declaration, signed by the company, in the form of model Sisorf 08.23.020.007, stating:

a) that it is aware of the legal and regulatory requirements and conditions to which elected or appointed administrators are subject for the exercise of their positions, as well as the grounds for ineligibility;

b) that it has conducted research regarding elected or appointed administrators in public and private registration and information systems and that they meet the legal and regulatory requirements and conditions necessary for the exercise of their positions;

c) that it has verified that elected or appointed administrators possess technical qualification compatible with the functions to be exercised during the term of office;

d) that it has been authorized by elected or appointed administrators to access any information, whether protected by legal confidentiality or not, or documents related to the analysis by the Central Bank of Brazil of their names for the exercise of positions and while their terms last;

e) that it has been authorized by elected or appointed administrators to be informed of the progress of the respective authorization, monitoring, or supervision processes and to obtain copies of documents contained therein, including those containing data belonging to them protected by any type of confidentiality, even those considered sensitive, in accordance with current legislation;

XII - declaration, in model Sisorf 08.23.010.001, demonstrating compliance with the requirement that the administration has knowledge of the business sector, the segment in which the institution intends to operate, market dynamics, sources of operational resources, management of activities, and risks associated with them;

XIII - declaration, signed by controllers, regarding the definition of control and agreements and other instruments concluded by shareholders or partners, in the form of model Sisorf 08.23.020.009;

XIV - declaration, in model Sisorf 08.23.010.001, regarding the filing, communication, and provision of agreements and other instruments concluded by shareholders or partners.

XV - reasonable assurance report issued by independent audit registered with the Securities and Exchange Commission (CVM), in the form of Annex IV, in the case of virtual asset service providers. (Added by Normative Instruction BCB No. 739, of 5/29/2026.)

Sole Paragraph. The Central Bank of Brazil, considering the size of the institution, the complexity, and the risks of the business, may require the presentation, in whole or in part, of the business plan, according to the content provided in Annex I.

Article 6. In the case of a company whose constitutive act has been registered with the respective Commercial Registry, in the event of withdrawal, filing, or denial of the authorization request for operation, it must be proven, within fifteen days of its occurrence, the dissolution or the change of the company’s object to an activity not subject to authorization by the Central Bank of Brazil, with the consequent alteration of its corporate name.

Article 7. Upon issuance of the authorization for operation, the start date of activities must be reported to the Central Bank of Brazil within 5 days of the event, by including a record in Unicad.

Article 8. The provisions of this subsection do not apply to virtual asset service providers that were in operation on the date of entry into force of Resolution BCB No. 519, of November 10, 2025, and Resolution BCB No. 520, of November 10, 2025, which must observe the provisions of Subsection II.

Subsection II

Application by Virtual Asset Service Providers in Operation

Article 9. In phase 1, the authorization request for operation must be processed, by October 30, 2026, with the following documents:

I - application, in the form of model Sisorf 08.23.010.002;

II – declaration, signed by the institution, stating that it was in operation on the date of entry into force of Resolution BCB No. 519, of 2025, and Resolution BCB No. 520, of 2025, in the form of model Sisorf 08.23.020.010;

III - declaration, signed by controllers and holders of qualified participation who are natural persons, stating that they meet the requirement of unblemished reputation and the conditions established by legislation and current regulations, in the form of model Sisorf 08.23.020.003;

IV - declaration, signed by controllers and holders of qualified participation, excluding natural persons, stating that they meet the conditions established by legislation and current regulations, in the form of model Sisorf 08.23.020.004, except for controllers or holders of qualified participation who are institutions authorized by the Central Bank of Brazil;

V - authorization, signed by controllers and holders of qualified participation, except for controllers or holders of qualified participation who are institutions authorized by the Central Bank of Brazil, in the form of model Sisorf 08.23.020.003 or 08.23.020.004:

a) to the Brazilian Federal Revenue Secretariat, for the provision to the Central Bank of Brazil of the Individual Income Tax Return or the Legal Entity Economic-Fiscal Information Declaration, as applicable, regarding the last three fiscal years, except in the case of a legal entity headquartered abroad or an investment fund, for the exclusive use of the Central Bank of Brazil in the respective authorization process;

b) to the Central Bank of Brazil, for access to information about themselves in any public or private registration and information system, including judicial or administrative proceedings and police inquiries;

c) to the Central Bank of Brazil, to carry out the processing and shared use of personal data belonging to them, including those considered sensitive and covered by confidentiality, in accordance with current legislation;

VI - declaration, signed by controllers, regarding the definition of control and agreements and other instruments concluded by shareholders or partners, in the form of model Sisorf 08.23.020.009;

VII - declaration, in model Sisorf 08.23.010.002, regarding the filing, communication, and provision of agreements and other instruments concluded by shareholders or partners;

VIII - financial statements of the institution for the last three fiscal years, audited by an independent auditor registered with the Securities and Exchange Commission.

Article 10. In phase 2, the authorization request for operation must be processed, within a period of up to sixty days counted from the Central Bank of Brazil’s favorable response to phase 1 of the said request, with the following documents and information:

I - application, in the form of model Sisorf 08.23.010.003;

II - declaration, signed by controllers, stating that they meet the economic and financial capacity requirement, compatible with the capital necessary for the institution’s structuring and operation, as well as contingencies arising from market dynamics, in the form of model Sisorf 08.23.020.001, except in the case of a company controlled by an institution authorized by the Central Bank of Brazil, or for a controller who is a natural person resident or domiciled abroad or a legal entity headquartered abroad;

III - information and supporting documentation demonstrating compliance with the economic and financial capacity requirement, compatible with the capital necessary for the institution’s structuring and operation, as well as contingencies arising from market dynamics, through which the equity evolution over the last three fiscal years can be verified, regarding controllers who are natural persons resident or domiciled abroad or legal entities headquartered abroad;

IV - declaration of the origin of resources used by controllers and holders of qualified participation in the integration of share capital, in the form of model Sisorf 08.23.020.002, except for controllers or holders of qualified participation who are institutions authorized by the Central Bank of Brazil;

V - executive summary of the business plan, in the form of Annex II;

VI - declaration, signed by elected or appointed administrators, stating that they meet the requirements of unblemished reputation and technical qualification compatible with the functions to be exercised during the term of office, as well as the conditions established by legislation and current regulations, in the form of model Sisorf 08.23.020.005 or 08.23.020.006;

VII - authorization, signed by elected or appointed administrators, in the form of model Sisorf 08.23.020.005 or 08.23.020.006, granting the Central Bank of Brazil, during the process of approval of their names and the period of office:

a) access to information about themselves, in any public or private registration and information system, including judicial or administrative proceedings and police inquiries;

b) to carry out the processing and shared use of personal data belonging to them, including those considered sensitive and covered by confidentiality, in accordance with current legislation;

VIII - declaration, signed by the company, in the form of model Sisorf 08.23.020.007, stating:

a) that it is aware of the legal and regulatory requirements and conditions to which elected or appointed administrators are subject for the exercise of their positions, as well as the grounds for ineligibility;

b) that it has conducted research regarding elected or appointed administrators in public and private registration and information systems and that they meet the legal and regulatory requirements and conditions necessary for the exercise of their positions;

c) that it has verified that elected or appointed administrators possess technical qualification compatible with the functions to be exercised during the term of office;

d) that it has been authorized by elected or appointed administrators to access any information, whether protected by legal confidentiality or not, or documents related to the analysis by the Central Bank of Brazil of their names for the exercise of positions and while their terms last;

e) that it has been authorized by elected or appointed administrators to be informed of the progress of the respective authorization, monitoring, or supervision processes and to obtain copies of documents contained therein, including those containing data belonging to them protected by any type of confidentiality, even those considered sensitive, in accordance with current legislation;

IX - declaration, in model Sisorf 08.23.010.003, demonstrating compliance with the requirement that the administration has knowledge of the business sector, the segment in which the institution operates, market dynamics, sources of operational resources, management of activities, and risks associated with them.

X - reasonable assurance report issued by independent audit registered with the Securities and Exchange Commission (CVM), in the form of Annex IV. (Added by Normative Instruction BCB No. 739, of 5/29/2026.)

§ 1. The deadline referred to in the main text may be extended for up to sixty days, at the discretion of the Central Bank of Brazil, upon justified request by the interested party.

§ 2. The Central Bank of Brazil, considering the size of the institution, the complexity, and the risks of the business, may require the presentation, in whole or in part, of the business plan, according to the content provided in Annex I.

Section III

Change of Virtual Asset Service Provider Company Modality

Article 11. The authorization request for a change of modality of virtual asset service provider company must be processed, within a period of up to thirty days from the respective act or deliberation, with the following documents:

I - application, in the form of model Sisorf 08.23.010.004;

II - well-founded justification demonstrating the economic and financial viability of the venture and the compatibility of the information technology infrastructure and corporate governance structure with the complexity and risks of the business, in the form of Annex III;

III - declaration, in model Sisorf 08.23.010.004, demonstrating compliance with the requirement that the administration has knowledge of the business sector, the segment in which the institution intends to operate, market dynamics, sources of operational resources, management of activities, and risks associated with them, except in the case of changing from the brokerage modality to the intermediary or custodian modality;

IV - declaration, in model Sisorf 08.23.010.004, stating that all unauthorized passive operations for the intended modality have been liquidated, in the case of changing to the intermediary or custodian modality.

Section IV

Authorization for Transfer or Change of Control

Article 12. The authorization request for the transfer or change of corporate control must be processed, within a period of up to thirty days from the corresponding legal act, with the following documents and information:

I - application, in the form of model Sisorf 08.23.010.005;

II - declaration, signed by the new controllers, stating that they meet the economic and financial capacity requirement, compatible with the capital necessary for the institution’s structuring and operation, as well as contingencies arising from market dynamics, in the form of model Sisorf 08.23.020.001, except in the case of transfer of control to an institution authorized by the Central Bank of Brazil, or for a new controller who is a natural person resident or domiciled abroad or a legal entity headquartered abroad;

III - information and supporting documentation demonstrating compliance with the economic and financial capacity requirement, compatible with the capital necessary for the institution’s structuring and operation, as well as contingencies arising from market dynamics, through which the equity evolution over the last three fiscal years can be verified, regarding a new controller who is a natural person resident or domiciled abroad or a legal entity headquartered abroad;

IV - declaration, signed by the new controllers and new holders of qualified participation, of the origin of resources used in the operation, in the form of model Sisorf 08.23.020.002, except for new controllers or new holders of qualified participation who are institutions authorized by the Central Bank of Brazil;

V - well-founded justification demonstrating the economic and financial viability of the venture, in cases of change of strategic or operational nature, in the form of Annex III;

VI - declaration, signed by the new controllers and new holders of qualified participation who are natural persons, stating that they meet the requirement of unblemished reputation and the conditions established by legislation and current regulations, in the form of model Sisorf 08.23.020.003;

VII - declaration, signed by the new controllers and new holders of qualified participation, excluding natural persons, stating that they meet the conditions established by legislation and current regulations, in the form of model Sisorf 08.23.020.004, except for new controllers or new holders of qualified participation who are institutions authorized by the Central Bank of Brazil;

VIII - authorization, signed by the new controllers and new holders of qualified participation, except for new controllers or new holders of qualified participation who are institutions authorized by the Central Bank of Brazil, in the form of model Sisorf 08.23.020.003 or 08.23.020.004:

a) to the Brazilian Federal Revenue Secretariat, for the provision to the Central Bank of Brazil of the Individual Income Tax Return or the Legal Entity Economic-Fiscal Information Declaration, as applicable, regarding the last three fiscal years, except in the case of a legal entity headquartered abroad or an investment fund, for the exclusive use of the Central Bank of Brazil in the respective authorization process;

b) to the Central Bank of Brazil, for access to information about themselves in any public or private registration and information system, including judicial or administrative proceedings and police inquiries;

c) to the Central Bank of Brazil, to carry out the processing and shared use of personal data belonging to them, including those considered sensitive and covered by confidentiality, in accordance with current legislation;

IX - purchase and sale contract, deed of donation, formal partition, or equivalent instrument, which must contain a clause conditioning the realization of the transaction on approval by the Central Bank of Brazil;

X - declaration, signed by the controllers, regarding the definition of control and agreements and other instruments executed by shareholders or partners, in the Sisorf model 08.23.020.009;

XI - declaration, in the Sisorf model 08.23.010.005, regarding the filing, communication, and provision of agreements and other instruments executed by shareholders or partners.

Section V

Authorization for Merger, Spin-off, or Incorporation

Art. 13. The request for authorization for merger, spin-off, or incorporation must be accompanied, within a period of up to thirty days from the respective act or resolution, by the following documents:

I - application, in the Sisorf model 08.23.010.006;

II - justified statement proving the economic and financial viability of the venture, in the form of Annex III;

III - balance sheet, relative to the base date of the operation, of the institutions authorized to operate by the Central Bank of Brazil involved;

IV - protocol and justification and expert valuation reports.

Section VI

Authorization for Corporate Transformation

Art. 14. The request for authorization for corporate transformation must be accompanied, within a period of up to fifteen days from the respective act or resolution, by the application, in the Sisorf model 08.23.010.007.

Section VII

Authorization for Assumption and Exercise of Elected or Appointed Positions in Management

Art. 15. The request for authorization for the assumption and exercise of elected or appointed positions in management must be accompanied, within a period of up to fifteen days from the respective act or resolution, by the following documents:

I - application, in the Sisorf model 08.23.010.008 or 08.23.010.009;

II - declaration, signed by the elected or appointed administrators, stating that they meet the requirements of good reputation and technical qualification compatible with the functions to be exercised during the term, as well as the conditions established by legislation and current regulations, in the Sisorf model 08.23.020.005 or 08.23.020.006, except for those elected or appointed referred to in § 2º;

III - authorization, signed by the elected or appointed administrators, in the Sisorf model 08.23.020.005 or 08.23.020.006, to the Central Bank of Brazil to, during the approval process of their names and the period of exercise of the position, except for those elected or appointed referred to in § 2º:

a) access to information about them, in any public or private registration and information system, including judicial or administrative proceedings and police inquiries;

b) carry out the processing and shared use of personal data under their ownership, including those considered sensitive and covered by confidentiality, in accordance with current legislation;

IV - declaration, signed by the institution, in the Sisorf model 08.23.020.007, of:

a) being aware of the legal and regulatory requirements and conditions to which the elected or appointed administrators are subject for the exercise of the positions, as well as the hypotheses of ineligibility;

b) having conducted research regarding the elected or appointed administrators in public and private registration and information systems, and that they meet the legal and regulatory requirements and conditions necessary for the exercise of the positions;

c) having verified that the elected or appointed administrators possess technical qualification compatible with the functions to be exercised during the term;

d) having been authorized by the elected or appointed administrators to have access to any information, protected by confidentiality or not, or documents related to the analysis by the Central Bank of Brazil of their names for the exercise of the positions and while their terms last;

e) having been authorized by the elected or appointed administrators to be aware of the processing of their respective authorization, monitoring, or supervision processes and to obtain copies of documents contained therein, including those containing data under their ownership protected by any kind of confidentiality, even those considered sensitive, in accordance with current legislation.

§ 1º Information regarding the dates of assumption, resignation, dismissal, and temporary absences exceeding fifteen days of holders of management positions, as well as the transfer to another management position within the same statutory or contractual body, must be communicated to the Central Bank of Brazil via Unicad within five days of the event.

§ 2º The documentation provided for in items II and III of the caput, in the Sisorf model 08.23.020.005, must be kept by the institution for submission to the Central Bank of Brazil when requested, in the case of an elected or appointed person to a management position with a term in force in a management body within the same institution or another institution authorized to operate by the Central Bank of Brazil that is part of a prudential conglomerate in which it participates.

§ 3º The provisions of § 2º do not apply to institutions governed by Law No. 13.303, of June 30, 2016.

Section VIII

Authorization for Change of Social Capital

Art. 16. The request for authorization for change of social capital must be accompanied, within a period of up to fifteen days from the respective act or resolution, by the following documents:

I - application, in the Sisorf model 08.23.010.010;

II - indication, in the Sisorf model 08.23.010.010, of the source of resources used by controllers and holders of qualified participation in the integration of the capital increase;

III - in the case of capital reduction, a justified statement proving the economic and financial viability of the venture, in the form of Annex III;

IV - documentation proving the source of resources used by controllers and holders of qualified participation in the integration of social capital, except for a controller or holder of qualified participation that is an institution authorized by the Central Bank of Brazil, in the following cases:

a) capital increase in a value greater than 50% of the social capital, considering, if applicable, the sum of successive increases in the six months prior to the authorization request;

b) capital increase in situations of non-compliance with operational limits; or

c) capital increase provided for in a regularization plan.

Section IX

Authorization for Change of Corporate Name

Art. 17. The request for authorization for change of corporate name must be accompanied, within a period of up to fifteen days from the respective act or resolution, by the application, in the Sisorf model 08.23.010.011.

Section X

Authorization for Change of Corporate Object

Art. 18. The request for authorization for change of corporate object must be accompanied, within a period of up to fifteen days from the respective act or resolution, by the following documents:

I - application, in the Sisorf model 08.23.010.012;

II - justified statement proving the economic and financial viability of the venture, in the form of Annex III;

III - declaration, in the Sisorf model 08.23.010.012, stating that all unauthorized passive operations for the intended object have been settled, if applicable.

Section XI

Cancellation of Operating Authorization

Art. 19. The request for cancellation of operating authorization must be accompanied, within a period of up to fifteen days from the respective act or resolution, by the following documents:

I - application, in the Sisorf model 08.23.010.013;

II - declaration, in the Sisorf model 08.23.010.013, stating that all operations exclusive or permitted to the institution by virtue of its respective authorization have been settled or transferred;

III - statement of responsibility, in the Sisorf model 08.23.020.008.

Section XII

Authorization and Cancellation of Authorization to Operate in the Foreign Exchange Market

Art. 20. The request for authorization or cancellation of authorization to operate in the foreign exchange market must be accompanied, within a period of up to fifteen days from the respective act or resolution, by the following documents:

I - application, in the Sisorf model 08.23.010.014 or 08.23.010.015;

II - justified statement proving the economic and financial viability of the venture and the compatibility of the information technology infrastructure and corporate governance structure with the complexity and risks of the business, in the case of a request for authorization to operate in the foreign exchange market, in the form of Annex III;

III - declaration, in the Sisorf model 08.23.010.015, stating that foreign exchange operations exclusive or permitted to the institution have been settled or transferred, in the case of a request for cancellation of authorization to operate in the foreign exchange market.

Section XIII

Authorization for Dissolution of the Audit Committee

Art. 21. The request for authorization for dissolution of the audit committee must be accompanied, within a period of up to fifteen days from the respective act, by the application in the Sisorf model 08.23.010.016.

CHAPTER III

COMMUNICATIONS

Section I

Assumption of the Status of Holder of Qualified Participation

Art. 22. The assumption of the status of holder of qualified participation must be communicated to the Central Bank of Brazil, within a period of up to fifteen days of its occurrence, in the Sisorf model 08.23.030.001.

Section II

Change in Management Position Structure

Art. 23. The change in the management position structure provided for in the articles of incorporation or social contract must be communicated to the Central Bank of Brazil, within a period of up to fifteen days from the respective act or resolution, by including a record in Unicad.

Section III

Capital Increase Resulting from Accumulated Profits, Capital Reserves and Profits, or Credits to Shareholders

Art. 24. Capital increases integrated with resources originating from accumulated profits, capital reserves, and profits or credits to shareholders as remuneration for capital must be communicated to the Central Bank of Brazil, within a period of up to fifteen days of their occurrence, by including a record in Unicad.

Art. 24. Capital increases integrated with resources originating from accumulated profits, capital reserves, and profits, or credits to shareholders as remuneration for capital, must be communicated to the Central Bank of Brazil, within a period of up to fifteen days of their occurrence, by including a record in Unicad, according to the outline available in subsection 3.3.40.120 of Sisorf. (Wording given by Normative Instruction BCB No. 739, of 5/29/2026.)

CHAPTER IV

FINAL PROVISIONS

Art. 25. The deadline for the presentation of objections by the general public regarding information disclosed by the Central Bank of Brazil about interested parties in assuming the status of controller, elected or appointed to management positions, and cancellation of operating authorization shall be fifteen days, counted from the date of disclosure.

Art. 26. This Normative Instruction enters into force on February 2, 2026.

Daniel Brito de Castro Bichuette
Substitute Chief

ANNEX I

CONTENT OF THE BUSINESS PLAN

Art. 1º The business plan, covering at least five years of activity, must be composed of:

I - marketing plan, which must include:

a) strategic objectives of the venture and market opportunities that justify the venture;

b) analysis of the market segment in which the institution operates or intends to operate, with indication of the target audience, main competitors, and intended market share;

c) main products and services offered or to be offered;

II - operational plan, which must detail the following aspects:

a) history, organizational chart of the economic group, and, if applicable, the relationship the institution intends to maintain with other persons comprising the group, or information that the institution does not belong to an economic group;

b) organizational chart of the institution, with indication of the number of employees;

c) physical structure, including its location, and distribution channels for products and services;

d) services relevant for the provision of virtual asset services, contracted or to be contracted in the country and abroad, if applicable, in accordance with art. 33 of BCB Resolution No. 520, of November 10, 2025, with indication of the type of service, the provider, respective location, and main contract conditions;

e) standards and corporate governance structure and its compatibility with the complexity and risks of the business;

f) information technology infrastructure and its compatibility with the complexity and risks of the business;

g) internal controls structure, risk management, and indication of the policy, risk assessment, systems, procedures, and controls for the detection and prevention of operations whose characteristics may indicate the existence of crimes defined in Law No. 9.613, of March 3, 1998;

III - financial plan, which must contain:

a) economic premises, with indication of estimates of indicators used in projections and their respective research sources;

b) project premises, with indication of estimates of rates, deadlines, and average values of operations, service fees, delinquency, capital structure, financing sources, and indication of critical variables for the success of the venture;

c) projection of financial statements and cash flow, prepared on a monthly basis and in compliance with the Accounting Plan of Institutions of the National Financial System (Cosif), as well as with the operational limits referred to in prudential regulation;

d) evaluation of the economic and financial viability of the venture, with indication of the methodology used;

e) indication of the deadline for the start of activities after the grant, by the Central Bank of Brazil, of the operating authorization, which may not exceed twelve months, in accordance with art. 1.124 of Law No. 10.406, of January 10, 2002.

§ 1º The presentation of the content of item II, letter “a”, of the caput, is waived for societies controlled by institutions authorized by the Central Bank of Brazil.

§ 2º The projection referred to in item III, letter “c”, of the caput, must be presented via an open spreadsheet, in which it is possible to identify the formulas used in the calculations of the cells that integrate it.

ANNEX II

CONTENT OF THE EXECUTIVE SUMMARY OF THE BUSINESS PLAN

Art. 1º The executive summary of the business plan must contain:

I - description of the business, strategic objectives of the venture, and market opportunities that justify the venture;

II - analysis of the market segment in which the institution operates or intends to operate, with indication of the target audience, main competitors, and intended market share;

III - main products and services offered or to be offered;

IV - history, organizational chart of the economic group, and, if applicable, the relationship the institution intends to maintain with other persons comprising the group, or information that the institution does not belong to an economic group;

V - physical structure, including its location, and distribution channels for products and services;

VI - services relevant for the provision of virtual asset services, contracted or to be contracted in the country and abroad, if applicable, in accordance with art. 33 of BCB Resolution No. 520, of November 10, 2025, with indication of the type of service, the provider, respective location, and main contract conditions;

VII - standards and corporate governance structure and its compatibility with the complexity and risks of the business;

VIII - information technology infrastructure and its compatibility with the complexity and risks of the business;

IX - internal controls structure, risk management, and indication of the policy, risk assessment, systems, procedures, and controls for the detection and prevention of operations whose characteristics may indicate the existence of crimes defined in Law No. 9.613, of March 3, 1998;

X - project premises, with indication of critical variables for the success of the venture;

XI - evaluation of the economic and financial viability of the venture, with indication of the methodology used;

XII - indication of the deadline for the start of activities after the grant, by the Central Bank of Brazil, of the operating authorization, which may not exceed twelve months, in accordance with art. 1.124 of Law No. 10.406, of January 10, 2002.

Sole Paragraph. The presentation of the content of item IV of the caput is waived for societies controlled by institutions authorized by the Central Bank of Brazil.

ANNEX III

CONTENT OF THE JUSTIFIED STATEMENT

TRANSFER OR CHANGE OF CONTROL

Art. 1º The justified statement for transfer or change of control must contain:

I - history and organizational chart of the economic group to which the institution will belong, and, if applicable, the indication of the relationship the institution intends to maintain with other persons comprising the economic group, or information that the institution will not belong to an economic group;

II - strategic nature impacts, specifying, if applicable, the new strategic objectives and market opportunities that justify the change of control;

III - operational nature impacts, specifying, if applicable, changes in standards and corporate governance structure, internal controls, risk management, and the policy, risk assessment, systems, procedures, and controls for the detection and prevention of operations whose characteristics may indicate the existence of crimes defined in Law No. 9.613, of March 3, 1998;

IV - economic and financial nature impacts, specifying, if applicable, estimates for critical variables such as rates, deadlines, and average values of operations, service fees, delinquency, capital structure, financing sources, as well as expected results;

V - information that there will be no impact described in one or more of items II to IV of the caput resulting from the change or transfer of control, if applicable.

Sole Paragraph. The presentation of the content of item I of the caput is waived if the new controllers are institutions authorized by the Central Bank of Brazil.

INCORPORATION, MERGER OR SPIN-OFF, CHANGE OF CORPORATE OBJECT, AND FOREIGN EXCHANGE OPERATION

Art. 2º The justified statement for merger, spin-off, or incorporation, for change of corporate object, or for operating in the foreign exchange market must contain:

I - strategic nature impacts, specifying, if applicable, the new strategic objectives and market opportunities that justify the operation;

II - operational nature impacts, specifying, if applicable, changes in standards and corporate governance structure, internal controls, and risk management, information technology infrastructure, and the policy, risk assessment, systems, procedures, and controls for the detection and prevention of operations whose characteristics may indicate the existence of crimes defined in Law No. 9.613, of March 3, 1998;

III - economic and financial nature impacts, specifying, if applicable, estimates for critical variables such as rates, deadlines, and average values of operations, service fees, delinquency, capital structure, financing sources, as well as expected results;

IV - impact of the operation on the operational limits established in current regulation;

V - deadline for the start of activities with the new corporate object or foreign exchange operation, after authorization.

CAPITAL REDUCTION

Art. 3º The justified statement for capital reduction must contain:

I - motivation for the reduction in accordance with current legislation;

II - impact of the operation on the operational limits established in current regulation.

CHANGE OF MODALITY OF SOCIETY PROVIDING VIRTUAL ASSET SERVICES

Art. 4º The justified statement for the change of modality of society providing virtual asset services must contain:

I - strategic nature impacts, specifying, if applicable, the new strategic objectives and market opportunities that justify the change;

II - operational nature impacts, specifying, if applicable, changes in standards and corporate governance structure, internal controls, and risk management, information technology infrastructure, the policy, risk assessment, systems, procedures, and controls for the detection and prevention of operations whose characteristics may indicate the existence of crimes defined in Law No. 9.613, of March 3, 1998, and in the contracting of services relevant for the provision of virtual asset services, in accordance with art. 33 of BCB Resolution No. 520, of November 10, 2025, with indication of the type of service, the provider, respective location, and main contract conditions;

III - economic and financial nature impacts, specifying, if applicable, estimates for critical variables such as rates, deadlines, and average values of operations, service fees, delinquency, capital structure, financing sources, as well as expected results;

IV - impact of the change on the operational limits established in current regulation;

V - deadline for the start of activities with the new modality, after authorization.

ANNEX IV

CONTENT OF THE REASONABLE ASSURANCE REPORT

(Annex IV included by Normative Instruction BCB No. 739, of 5/29/2026.)

Art. 1º The reasonable assurance report regarding the detection and prevention of operations whose characteristics may indicate the existence of crimes defined in Law No. 9.613, of March 3, 1998, must contain a conclusive opinion on the following aspects:

I - institutional policy, organizational structure, and employee qualification, which must include:

a) institutional policy:

1. verification if the policy is documented and approved by the Board of Directors or, in its absence, by the Management Board of the society;

2. verification if the policy includes the guidelines provided for in art. 3º, item I, of Circular No. 3.978, of January 23, 2020;

3. verification if the policy includes guidelines for implementing procedures provided for in art. 3º, item II, of Circular No. 3.978, of January 23, 2020;

b) organizational structure:

1. verification if the structure is compatible with the size and volume of operations of the society;

2. verification if there is a conflict of interest between the management of procedures for the detection and prevention of the operations referred to in the caput and the business areas of the society;

c) employee training: verification of the compatibility of the content, application method, and controls regarding training with the activities performed by employees, including the employees of its correspondents in the country;

II - internal risk assessment related to the use of products and services of the company in the practice of the crimes referred to in the caput, which must include:

a) formalization of the procedure: verification of the existence of an internal risk assessment, its approval by the responsible director, and knowledge by the Risk Committee and the Audit Committee, when they exist, and by the Board of Directors or, if none exists, by the Company's Executive Board;

b) risk profiles: verification that the internal risk assessment considers the risk profiles of clients, the company, operations, transactions, products, and services, covering all distribution channels and the use of new technologies, and the activities performed by employees, business partners, and outsourced service providers, and an evaluation of the criteria used to define risk categories;

III - procedures designed to know your clients, which must include:

a) formalization of procedures: verification of the existence of a specific manual of procedures designed to know clients and an evaluation of the compatibility of these procedures with the internal risk assessment;

b) client identification: evaluation of the adequacy of procedures for collecting, verifying, validating, and storing evidence for client identification, including their representatives and administrators, in the case of legal entities;

c) client qualification:

1. evaluation of the adequacy of procedures for collecting, validating, verifying, and analyzing data on clients' financial capacity, as well as on other qualification elements and the storage of evidence, and their compatibility with the clients' risk profile;

2. evaluation of the adequacy of procedures that allow qualifying clients, their representatives, and ultimate beneficiaries, in the case of a legal entity, as politically exposed persons or as persons related to politically exposed persons;

3. verification that the company has procedures for identifying and qualifying the ultimate beneficiary of a corporate client;

4. evaluation of the adequacy of procedures for the reputational qualification of the client, including their representatives and administrators, in the case of legal entities, in the process of initiating the relationship with the company;

5. evaluation of the adequacy of enhanced due diligence procedures for politically exposed persons, high-risk clients, and jurisdictions under the monitoring of the Financial Action Task Force – FATF;

d) client classification: evaluation of the adequacy of procedures for classifying clients into the risk categories defined in the internal risk assessment;

IV - procedures designed to know your partners, which must include:

a) formalization of procedures: evaluation of the adequacy of the formalization of procedures related to the company's partners;

b) partner identification: evaluation of the adequacy of procedures for identifying the company's partners;

c) partner qualification: evaluation of the adequacy of procedures for qualifying the company's partners;

d) partner classification: evaluation of the adequacy of procedures for classifying the company's partners;

V - monitoring, selection, analysis, and communication of operations and situations suspected of money laundering and terrorist financing and weapons of mass destruction, which must include:

a) formalization of procedures: verification of the existence of a specific manual of procedures for monitoring, selection, and analysis, and an evaluation of the compatibility of these procedures with the internal risk assessment;

b) monitoring and selection of operations:

1. evaluation of the existence and scope of parameters, variables, rules, and scenarios used in the procedures for monitoring and selecting operations;

2. evaluation of the compatibility of the monitoring and selection procedures and tools with the size, volume, and complexity of the company's operations;

c) analysis of operations:

1. evaluation of the procedures for analyzing operations and suspected situations, observing, among other aspects, the adequacy of the information collected, the scope, and the depth of the analyses;

2. evaluation of the adequacy of procedures for formalizing dossiers, including the decision to communicate to the Financial Activities Control Council – Coaf, and the conservation of these dossiers for a period of ten years;

3. evaluation of the adequacy of the company's authorities for archiving or forwarding alerts and for the decision to communicate to Coaf;

4. evaluation of the adequacy of the procedures for monitoring, selecting, and analyzing operations related to the crimes referred to in the caput;

5. verification if the structure is sufficient for the analysis of all generated alerts;

d) communications to Coaf:

1. verification if the company's procedures determine that communications to Coaf must be made without informing the involved parties or third parties;

2. verification if the company has procedures for mandatory communication to Coaf regarding cash operations;

3. evaluation of the adequacy of the deadlines for communications;

VI - monitoring and analysis regarding indications of the occurrence or attempt of fraud and scams, which must include:

a) monitoring regarding indications of fraud: evaluation of the adequacy of the transactional monitoring procedures for preventing fraud and scams executed by the company;

b) analysis regarding indications of fraud and scams: evaluation of the adequacy of the procedures for analyzing situations alerted by transactional monitoring for preventing fraud and scams;

VII - administrative blocking of assets, which must include:

a) monitoring, detection, and blocking:

1. evaluation of the adequacy of the procedures defined to monitor determinations of asset unavailability resulting from Resolutions of the United Nations Security Council – UNSC or from designations by its sanctions committees;

2. evaluation of the adequacy of the procedures for monitoring the existence or emergence of client assets reached by the determinations of BCB Resolution No. 44, of November 24, 2020, so that, as soon as detected, they are placed under the regime of unavailability;

b) communication to authorities: evaluation of the adequacy of the procedures defined for communicating blocks to the Central Bank of Brazil, the Ministry of Justice and Public Security, and Coaf;

VIII - record of operations, which must include:

a) record of operations performed, products, and services contracted: verification if the records contain the minimum information about operations provided for in Art. 28 of Circular No. 3,978, of January 23, 2020;

b) payment, receipt, and transfer of funds operations: verification if the record of payment, receipt, and transfer of funds operations contains, in addition to the information provided for in Art. 28 of Circular No. 3,978, of January 23, 2020, the identification of the origin and destination of the funds determined in Art. 30 of the aforementioned Circular.

§1º The items V, letter “c”, items 1, 2, and 5, VI, letter “a”, VII, and VIII of the caput apply only to virtual asset service providers that were active on the date of entry into force of BCB Resolution No. 519, of November 10, 2025.

§2º Reasonable assurance reports issued in the last twelve months regarding the aspects mentioned may be considered in the issuance of the conclusive opinion.

ANNEX

NOTE

BCB Resolution No. 519, of November 10, 2025, regulates the authorization processes related to the operation of foreign exchange brokerage companies, securities brokerage companies, securities distribution companies, and virtual asset service providers. Based on the aforementioned resolution, this BCB Normative Instruction - IN BCB aims to disclose the procedures, documents, and information necessary for instructing the aforementioned authorization requests.

2. Decree No. 10,411, of June 30, 2020, regulates the conduct of regulatory impact analysis - RIA as a prerequisite for the issuance of normative acts. However, in its Article 4, the aforementioned decree establishes the hypotheses for dispensing with the conduct of RIA. This BCB IN falls under the hypothesis provided for in item II, as it does not bring any additional requirement to that contained in the current regulation and is intended to clarify the manner of compliance with obligations defined in a hierarchically superior norm. Thus, based on item II of Art. 4 of Decree No. 10,411, of 2020, I understand that the issuance of this normative instruction dispenses with the conduct of RIA.

Daniel Brito de Castro Bichuette
Acting Chief